“On Electron apps that do not properly sandbox JavaScript code, this vulnerability even leads to native code execution (!).”
PDF.js builds JavaScript function bodies out of font data, and a font matrix in the PDF gets pasted into that code without quotes. Open the file and the attacker’s script runs. Every Firefox before 126 was exposed, and pdfjs-dist pulls about 2.7 million npm downloads a week. The bad code path dates to the 2014 release. A PDF viewer that calls eval on attacker input was always going to end this way.